Description
The Token Insert Entity module 7.x-1.x before 7.x-1.1 for Drupal does not properly check permissions, which allows remote authenticated users with certain permissions to bypass intended access restrictions and possibly obtain sensitive information by inserting a token, which embeds a rendered entity in the main node.
References (2)
Core 2
Core References
Patch, Vendor Advisory x_refsource_misc
https://www.drupal.org/node/2627638
Patch x_refsource_confirm
https://www.drupal.org/node/2571905
Scores
EPSS
0.0091
EPSS Percentile
55.5%
Details
CWE
CWE-200
Status
published
Products (1)
token_insert_entity_project/token_insert_entity
7.x-1.0
Published
Dec 17, 2015
Tracked Since
Feb 18, 2026